I am sure this question has been answered before, but I can't seem to find a workable answer.

I have a CentOS 7 virtual machine running inside VirtualBox 5.2.20 hosted on a Windows 10 Pro computer. I set up an Apache web server on the guest and would like to make it reachable over the internet (e.g. to serve a static webpage over port 80). However, I would like my host and other devices in my LAN to be shielded off from the guest in case it gets compromised.

At the moment, I have two network adapters configured in VB, one NAT to give outbound internet access to the guest and one host-only adapter to test the web server locally. No port forwarding is set up at the moment, so the guest is reachable only from my host. My understanding is the following:

  • If I use NAT with port forwarding, I would have to open up the required port(s) on my host as well, making it vulnerable to potential exploits (I want to avoid that)
  • If I use Bridged mode, I can forward ports directly to my guest, but then it would also have access to other hosts on my LAN. If my guest gets hacked, they would be at risk.

Is my understanding correct? If yes, how can I set up the network to enable port forwarding to my guest only, without exposing the rest of my LAN to it?

  • 1
    I think this is impossible, in it's current form, to do what you want to do. I know on linux you could use NAT and then with IPTables you could only allow the NAT'd traffic out to the net and no where else but even then it's complicated. – djsmiley2k Oct 21 '18 at 9:35
  • Being still somewhat reluctant to open any port on my host, I wonder if I could use a second VM to act as a firewall (behind my router), e.g. running pfSense, creating a virtual DMZ with a different subnet to separate the guest from my LAN. Any thoughts out there on how this could be achieved? – silentsurfer Oct 23 '18 at 8:02

You need to port-forward to your computer, but you may direct that port directly to the network interface used by the VM so the VM can stay isolated. This might work with the host-only interface, so the VM will not be able to communicate with the rest of your network.

The command to use will look like this, running in an elevated Command Prompt, assuming that the host-only interface is defined on

netsh interface portproxy add v4tov4 listenport=80 listenaddress=
 connectaddress= connectport=80 protocol=tcp

I don't have VirtualBox so cannot experiment; you will have to do that part.

For more information see the article Windows Netsh Interface Portproxy.

  • Thanks harry, I'll give it a try. Could you please explain why port proxying is safer (from the host's point of view) than, say, using VB's port forwarding functionality? – silentsurfer Oct 21 '18 at 14:27
  • It doesn't need NAT or Bridged, and is done on the level of Windows. – harrymc Oct 21 '18 at 14:39
  • That's a good point, at least it provides a switch to turn off internet access via NAT to the guest when not needed for updates etc. But in terms of security when opening ports on the host, is there a difference between proxying and port forwarding via VB and NAT? – silentsurfer Oct 21 '18 at 20:33
  • The difference is the level of isolation of the VM from your network. I don't think NAT totally does isolation. – harrymc Oct 21 '18 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.